<foo id=test1>>><body id=test2 '><bdi id=test3><keygen>
<test><script>
var docElement = document.body ? document.body : document.documentElement;
function initCF() {
try { test4 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); } catch(e) {}
try { docElement.appendChild(test4); } catch(e) {}
try { test5 = test3.cloneNode(true); } catch(e) {}
try { test5.setAttribute("dir", "invalid"); } catch(e) {}
try { docElement.appendChild(test5); } catch(e) {}
setTimeout("CFcrash()", 0);
}
document.addEventListener("DOMContentLoaded", initCF, false);
function CFcrash() {
try { test1.appendChild(test4); } catch(e) {}
try { document.adoptNode(test2); } catch(e) {}
}</script>>